What is known about latest data breach for Revolut users?

Revolut customers in Ireland are among those impacted by a data breach at a third-party provider.

DriveWealth, a US broker that carries out US stock trades for Revolut customers, said a security incident affecting its systems involved unauthorised access to historical personal data of some of its customers.

This is the second data breach affecting Revolut customers this month, but what do we know about the latest breach?

How extensive is it?

It is hard to tell, and a lot of the reason for this is that this is a breach involving one of Revolut's third-party providers.

DriveWealth is a US broker that carries out American stock trades for Revolut customers.

It says there was a security incident affecting its systems earlier this month that it involved unauthorised access to the historical personal data of some customers.

It is very possible Revolut itself doesn't know the full extent of this breach yet, and fintech says it's in "direct communication" with DriveWealth to figure this out.

What sort of personal information has been compromised?

There is a worrying level of personal data involved, including names, email addresses, phone numbers, postal addresses, and employment information.

But also what was potentially accessed was biographical data - such as country of citizenship, age, and gender.

Though, DriveWealth says it doesn't believe passwords, credit card or bank details are included.

For its part, Revolut confirmed its systems and infrastructure were not accessed or compromised, and that customer funds and investments are safe.

Who's affected?

Anyone who used Revolut to invest in US stocks up until December 2023 could be impacted, because after that point Revolut changed its US stock trading model and what information it shared with DriveWealth.

Those affected would have received an email from both Revolut and DriveWealth alerting them, but some customers have reported that the initial DriveWealth email about the breach might have gone into spam folders, so it is worth double checking there if you haven't seen a message from them and are worried you might be impacted.

What are the risks to customers?

The main risks from this breach to Revolut customers are that their personal data could be misused, and that they may be exposed to phishing attempts.

Phishing involves fraudulent emails or messages sent to people that are designed to trick them into revealing sensitive information.

So, this is something anyone who received emails from Revolut and DriveWealth about the breach should be vigilant of.

In addition, identity fraud or impersonation, as well as social engineering aimed at obtaining additional personal or financial information are risks to be aware of.

How many people are impacted?

Neither Revolut nor DriveWealth have confirmed how many Revolut customers in Ireland - or elsewhere - are caught up in this.

Revolut has about 3.4 million customers in Ireland, and more than 80 million overall, and this is the second data breach affecting Revolut customers this month.

Last week, the fintech company told some of its customers that copies of their passports and driving licenses, along with their dates of birth, home addresses, email addresses and phone numbers, were handed to criminals.

According to Revolut, this happened after an "unauthorised third party" used an email domain from a legitimate Government agency to submit "fraudulent requests for information".

The company did not say how many people were affected by that breach, or where they live - however, it was reported at the time that around 700 customers globally were impacted, with around 12 of those based in Ireland.

Based on this, I think it would be fair to surmise that this latest breach involving DriveWealth could be even more significant.